I am having trouble getting WireGuard to connect two of my networks (replacing a working, yet cumbersome OpenVPN solution). Both networks are on dynamic IPs and have DDNS set up for them.
I followed the tutorial on https://danrl.com/blog/2017/luci-proto-wireguard/ [Edit: I had the older, outdated tutorial URL here, I followed this newer one though] which seems straightforward enough but only describes one side of the setup. Following the tutorial, I set up the WireGuard interface and it seems to work fine. I opened UDP 51820 on router 1 and, for good measure, on router 2 too.
My setup is as follows, using placeholders for IPs and keys:
- router 1 is the edge router on network 10.0.0.0/24, IP 10.0.0.1, WireGuard interface 'wg0' is on 10.64.0.1
- router 2 is the edge router on network 10.1.0.0/24, IP 10.1.0.1, WireGuard interface 'wg0' is on 10.64.0.2
router 1, /etc/config/network:
config interface 'wg0' option proto 'wireguard' option private_key '<router 1 private key>' list addresses '10.64.0.1' config wireguard_wg0 option public_key '<router 2 public key>' option route_allowed_ips '1' list allowed_ips '10.64.0.0/24' list allowed_ips '10.1.0.0/24'
router 2, /etc/config/network:
config interface 'wg0' option proto 'wireguard' option private_key '<router 2 private key>' list addresses '10.64.0.2' config wireguard_wg0 option public_key '<router 1 public key>' option route_allowed_ips '1' option endpoint_router '<router 1's DDNS>' option persistent_keepalive '25' list allowed_ips '10.64.0.0/24' list allowed_ips '10.0.0.0/24'
My idea is that router 2 should try (and upon disconnect, retry) to connect to router 1 and establish the tunnel between the two networks.
Yet when I look at router 2, I only see the following:
root@router2:/tmp# wg show interface: wg0 public key: <router 2 public key> private key: (hidden) listening port: 51820 peer: <router 1 public key> endpoint: <router 1's correctly resolved IP>:51820 allowed ips: 10.64.0.0/24, 10.0.0.0/24 transfer: 0 B received, 16.62 KiB sent persistent keepalive: every 25 seconds
Never any handshake, and never anything received. Similarly on router 1. Even without the WireGuard interfaces assigned to any firewall zone (the tutorial never did that either), the tunnel should at least connect, no?
What am I missing?
Also, I looked at trying to at least connect to demo.wireguard.io, but I didn't manage to translate the demo shell script into a meaningful OpenWrt/UCI configuration.